How Many MikroTik Devices Are Actually Reachable From the Internet?

When CERT Polska disclosed the MikroTrick chain in MikroTik RouterOS on September 5, 2026, the practical question for defenders was not whether the flaw was serious. It was how much of the internet's RouterOS population is exposed to it. The exploit requires the SSH management service to be reachable from the internet, so exposure measurement is the first step in scoping the risk.

This article uses ZoomEye data collected on September 19, 2026 to put the exposure in context, and is explicit about what the numbers do and do not show.

What the flaw needs

MikroTrick combines CVE-2026-67276, a missing authentication weakness in the SSH public-key verification path, with CVE-2026-86060, an argument delimiter injection that escalates the session to administrator. Neither requires a password or a private key. The precondition is network reachability to the SSH service.

That precondition is what makes exposure measurement useful. A RouterOS device that is not reachable over SSH from the internet cannot be attacked through this chain, regardless of its software version.

Measuring the RouterOS population

ZoomEye queries run on September 19, 2026 returned the following counts. Each figure is the total number of matching records in the ZoomEye index at query time, not a count of confirmed vulnerable or compromised devices.

Query	Matching records
app="MikroTik"	31,069,202
app="RouterOS"	2,855,574
app="MikroTik RouterOS"	937,854
port="8291"	8,913,154

The spread between these numbers is the first thing to understand. app="MikroTik" matches any device whose fingerprint includes MikroTik, which covers a broad range of products and services. app="RouterOS" narrows to the operating system. app="MikroTik RouterOS" is narrower still. Port 8291 is the RouterOS Winbox management port, so that count describes a different exposure surface than SSH.

None of these queries identifies devices running a vulnerable RouterOS version, and none of them confirms that SSH is reachable. They measure the size of the population that could be examined further.

Reading the numbers carefully

Three cautions apply to this data.

First, fingerprint matching is not version detection. A record matching app="RouterOS" tells you the service identifies as RouterOS. It does not tell you whether the device runs 7.24.2, which is patched, or an older release that is not.

Second, the counts describe the index, not the internet. ZoomEye samples and indexes cyberspace; the totals reflect what the platform has observed and retained, not a complete census.

Third, exposure is not compromise. CERT Polska confirmed active exploitation, and public reporting cites more than 122,000 affected devices, but that figure describes exposed and potentially vulnerable instances rather than confirmed intrusions. Conflating the two leads to overstated conclusions in both directions.

Narrowing to the real risk

The population counts above are a starting point for scoping, not an answer. The operational question is which devices in your own inventory have SSH reachable from the internet. ZoomEye can help answer that for an organization's known address space, and the same logic applies to any external attack surface review: identify the assets, determine which services are reachable, and then check versions against the vendor's fixed releases.

For RouterOS specifically, the fixed versions are 6.49.21, 7.23.4, 7.24.2, and 7.25beta3, with 7.23.5 released on September 4. Patched builds also add a Flagged self-check that marks a device if it detects known tampering artifacts on boot.

What to do with the measurement

• Use exposure data to build a candidate list, then verify each device directly. Index counts cannot substitute for asset-level confirmation.
• Restrict SSH, WebFig, and the bandwidth-test service to a trusted management network. Removing internet reachability eliminates the attack precondition entirely.
• Check logs for SSH logins using the username -2 and audit local users for unauthorized accounts such as ops.
• Treat any device that reports itself as Flagged, or that shows signs of unauthorized configuration change, as compromised. Isolate it, preserve evidence, and rebuild rather than simply changing credentials.

Limitations

All counts in this article were collected on September 19, 2026 through ZoomEye and reflect the index at that time. They are population measurements, not vulnerability or compromise determinations. No version-level breakdown was performed, and no attempt was made to verify individual devices. The 122,000-device figure cited from public reporting is a third-party estimate of exposed and potentially vulnerable instances, not a confirmed compromise count.

References

• CERT Polska advisory on critical MikroTik RouterOS vulnerabilities, September 5, 2026.
• CISA Known Exploited Vulnerabilities Catalog entries for CVE-2026-67276 and CVE-2026-86060.
• MikroTik RouterOS release notes for 6.49.21, 7.23.4, 7.24.2, 7.25beta3, and 7.23.5.
• ZoomEye query results collected September 19, 2026.